--- title: "Exposed Services Checker — Free Open Port & CVE Scan" description: "Free exposed services checker. Find open ports, exposed databases, and known vulnerabilities for your domain using Shodan InternetDB." canonical: "https://lemwatch.com/tools/exposed-services-checker" source: "https://lemwatch.com" --- # Exposed Services Checker > See which ports and services your domain exposes to the public internet. Spot critical risks like open SSH, MySQL, Redis, or RDP before attackers do. Most production breaches don't start with a zero-day. They start with a port that shouldn't be open. This checker resolves your domain to an IP, queries Shodan's InternetDB (the same passive scan data security researchers and attackers use), and tells you exactly what the rest of the internet can see. ## The exposed-database problem Since 2017, security researchers have documented thousands of internet-exposed Redis, MongoDB, Elasticsearch, and PostgreSQL instances containing production data. Most weren't hacked — they were simply running on 0.0.0.0 with no authentication, and an automated scanner found them within hours of going live. If this tool shows port 6379 (Redis), 27017 (MongoDB), 9200 (Elasticsearch), or 5432 (PostgreSQL) open, you have minutes-to-hours before an automated scanner finds it. ## SSH on port 22 — why it matters Exposed SSH isn't a vulnerability by itself, but it's a constant target. A single internet-exposed SSH port will receive 1,000+ brute-force login attempts per day from the moment it's reachable. Best practice for years has been: SSH behind a VPN, or use a bastion host, or use AWS SSM / GCP IAP / Tailscale SSH. There's no good reason a production SSH port should be on the public internet. ## How Shodan finds you Shodan continuously scans the entire IPv4 internet, recording open ports and service banners. They publish a free passive lookup (InternetDB) that returns the open-port list and known CVEs for any IP. That's what we query — no active scanning, no impact on your servers, and the data is the same data attackers have access to. ## CVE matching via CPE When Shodan fingerprints a service it produces a CPE (Common Platform Enumeration) string like `cpe:2.3:a:nginx:nginx:1.18.0`. Known CVEs are mapped to CPEs in the NVD database. If our check returns vulnerabilities, those are real CVEs affecting your detected service version — patch them. ## Risk level interpretation - **Critical**: Known CVEs present, or admin database/management ports exposed. Fix today. - **High**: Critical service ports (SSH, RDP, SMB, FTP) reachable. Move behind VPN. - **Medium**: Many non-standard ports open. Audit each one. - **Low**: Only standard web ports (80, 443). Healthy baseline. ## What this tool checks - All open TCP ports visible to the internet - Critical exposures (SSH 22, MySQL 3306, Redis 6379, RDP 3389, MongoDB 27017, etc.) - Known CVEs affecting the detected services (CPE matching) - Server fingerprint tags from Shodan (cloud provider, OS, framework) - Subdomain hostnames sharing the same IP - Overall risk level (critical / high / medium / low) ## Why it matters Every unnecessary open port is an attack surface. Open Redis or MongoDB instances have caused some of the largest data breaches of the last decade. Even an exposed SSH port invites brute-force attacks that show up in your logs and inflate your bandwidth bill. ## How to fix what it finds - Close every port that doesn't need to be public (firewall / security group) - Put admin services (SSH, RDP) behind a VPN or bastion host - Bind databases to localhost or a private network — never 0.0.0.0 - Patch services flagged with known CVEs immediately - Run this check after every infrastructure change ## Methodology We resolve your domain to an A record using Google DNS-over-HTTPS, then query Shodan's public InternetDB endpoint for that IP. The response lists open TCP ports, server tags, hostnames sharing the IP, CPE strings, and any CVEs linked to those CPEs. We classify each port against a known table of critical services (databases, admin protocols, file shares), standard web services (80, 443, 8080, 8443), and unknowns. The overall risk level is derived: critical if any known CVE is present, high if any critical port is exposed, medium if >5 non-standard ports are open, low otherwise. We never actively port-scan your servers — all data comes from Shodan's passive scan, which is the same data attackers see anyway. ## Frequently asked questions ### Does this actually scan my server? No. We query Shodan's passive scan results. Your server sees no traffic from this check — Shodan already scanned the internet, we just look up what they found. ### My site uses Cloudflare. What IP do you check? You'll see Cloudflare's edge IP, which is the only IP exposed to the internet. Your origin IP behind Cloudflare is not checked (which is the correct behaviour — that's the value of using a proxy). ### What if a critical port is open but I need it? Restrict it at the firewall to only the IPs that need it (e.g. office IP, VPN range). Open-to-everyone is the problem; open-to-trusted-sources is fine. ### How current is the Shodan data? Shodan re-scans most of the IPv4 internet every 1–2 weeks. If you just closed a port, it may still show as open for up to two weeks until Shodan re-scans. ### Do you store my domain or results? For public visitors, no — results are returned to your browser and discarded. For authenticated LemWatch users, results are stored against your site for trend analysis. ## Related - [All free tools](https://lemwatch.com/tools) - [SSL Checker](https://lemwatch.com/tools/ssl-checker) - [Security Headers](https://lemwatch.com/tools/security-header-checker) - [Mozilla Observatory Scan](https://lemwatch.com/tools/mozilla-observatory-checker) - [noindex checker](https://lemwatch.com/tools/indexability-checker) - [Content Freshness Checker](https://lemwatch.com/tools/content-freshness-checker) - [Lemwatch pricing](https://lemwatch.com/pricing) - [All monitoring checks](https://lemwatch.com/features)